NIST Privacy Framework, Protect-PPR.PO-P10

Publish a means for a security issue affecting the device to be reported to the manufacturer, and provide status updates on the resolution of a reported issue.

Inform consumers of every vulnerability detected in that test, together with the solution recommended to remedy it.

Provide a dedicated, securely reachable channel, such as an HTTPS web form or a PGP-encrypted email address, for a customer, end user, or third party to report a security vulnerability, and publish a coordinated vulnerability-disclosure policy on your website covering how you want to be notified, what a reporter should expect, and your process's scope and limits.

Maintain a public, Portuguese-language support page listing known vulnerabilities in your products together with their mitigations, and keep making corrected software or firmware available.

On discovering a security defect, vulnerability, or other risk in your product or service, immediately take remedial measures, notify affected users as provided, and report the defect or vulnerability to the competent authority; the statute states no numeric clock for this notice, only immediacy.

Inform consumers of every vulnerability detected in your information and communication technology products and services, and of the solutions you have deployed to remedy them.

Maintain a support period of at least five years, or the product's expected use time if shorter, handle vulnerabilities in the product and its components throughout that period, and keep each security update available for ten years after release or for the remainder of the support period, whichever is longer.

From 11 December 2027 (Article 71(2)), when you identify a vulnerability in a component integrated in your product, including an open-source component, report the vulnerability to the person or entity manufacturing or maintaining the component and address and remediate it under the vulnerability handling requirements of Annex I, Part II. If you developed a software or hardware modification to address the vulnerability, share the relevant code or documentation with that person or entity, where appropriate in a machine-readable format (Article 13(6)).

Put in place and document, in a verifiable manner, a cybersecurity policy to foster the development of a secure product with digital elements and an effective handling of vulnerabilities by the developers of that product. Make the policy foster the voluntary reporting of vulnerabilities under Article 15 by those developers, take into account your specific nature and the legal and organizational arrangements to which you are subject, and include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community (Article 24(1)).

It reaches you if you hold an EUCC certificate for an ICT product issued under the European Common Criteria-based cybersecurity certification scheme; Chapter VI applies to ICT products for which an EUCC certificate was issued (Article 32). Establish and maintain all necessary vulnerability management procedures in accordance with Chapter VI, supplemented where necessary by the procedures set out in EN ISO/IEC 30111 (Article 33(1)).

Maintain and publish appropriate methods for receiving information on vulnerabilities related to your products from external sources, including users, certification bodies and security researchers (Article 33(2)).

Implement measures to detect and prevent cyber-attacks against vehicles of the type, support your monitoring of threats, vulnerabilities and cyber-attacks, and provide data forensic capability; mitigate threats and vulnerabilities that require a response within a reasonable timeframe, and monitor continually, including vehicles after first registration (paragraphs 7.3.7, 7.2.2.3 and 7.2.2.4).

As a manufacturer, keep for each device a procedure for handling an incident or vulnerability that a user finds, documenting its nature, giving detailed instructions for dealing with it and listing mitigation measures (Article 39).

If you are identified under DORA Article 26(8), carry out the advanced threat-led penetration testing that Articles 26(1) to (6) and (8) and 27 require (Section 7(1)(5)).

Apply patches in a controlled and timely way across your technology environment to address vulnerabilities and flaws.

Maintain practices, capabilities, processes and tools to identify and assess cyber security weaknesses that external and insider threat actors could exploit, and design, implement and maintain multi-layer preventive controls and continuous security detection capabilities.

Apply security patches within a reasonable time after they become available and test them before applying them in production systems, unless you document and substantiate a decision that the disadvantages of applying a patch outweigh the cybersecurity benefits (points 6.6.1 and 6.6.2).

Address without undue delay the vulnerabilities you identify as critical to your operations, and lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy (points 6.10.2(c) and (e)).

Develop, document and implement vulnerability management procedures that identify trustworthy information resources, perform automated vulnerability scanning and assessments (at least weekly for the ICT assets supporting critical or important functions), verify that ICT third-party service providers handle vulnerabilities and report at least the critical ones, track third-party and open-source libraries used by ICT services supporting critical or important functions, establish procedures for the responsible disclosure of vulnerabilities to clients, counterparties and the public, and prioritize the deployment of patches (Article 10(1) and (2)). Develop, document and implement patch management procedures that identify emergency procedures and set deadlines for installing patches and updates with escalation procedures in case those deadlines cannot be met (Article 10(3) and (4)).

Unless you are a microenterprise, establish procedures and policies to prioritize, classify and remedy all issues the tests reveal, set up internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed, and ensure at least yearly that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions (Article 24(5) and (6)).

Include in the program a range of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing (Article 25(1)). If you are a central securities depository or central counterparty, perform vulnerability assessments before any deployment or redeployment of applications and infrastructure components and of the ICT services supporting critical or important functions (Article 25(2)). If you are a microenterprise, combine a risk-based approach with strategic planning of ICT testing (Article 25(3)).

Have capabilities and staff to gather information on vulnerabilities, cyber threats and ICT-related incidents, run post-incident reviews after a major ICT-related incident disrupts your core activities, build the lessons from testing and real incidents into the ICT risk assessment, have senior ICT staff report at least yearly to the management body, and make ICT security awareness programs and digital operational resilience training compulsory modules for all employees and senior management (Article 13).

The Department says you should reassess your procedures for evaluating the criticality and threat of known vulnerabilities and review your vulnerability management timelines to determine whether accelerated detection and remediation processes are necessary, based on your updated risk assessments.

The Department says you should consider expeditiously identifying and remediating known exploited vulnerabilities in firmware, hardware and software, especially on systems exposed to the Internet; disabling inactive or unnecessary ports and protocols where possible; establishing network access protections and segmenting networks; and reviewing and validating cloud application configurations against your risk tolerance.

If the Finansinspektionen designates you to carry out threat-led penetration tests under DORA Article 26, carry them out as often as it decides, and give the Riksbank the information it requests for its oversight and coordination of the tests (chapter 2, sections 1 and 4).

Strengthen risk monitoring of your data-processing activity, and on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures.

Monitor any residual vulnerabilities to ensure that they cannot be exploited if the operational environment changes (Article 35(7)).

Upon withdrawal of the certificate, disclose and register any publicly known and remediated vulnerability in the ICT product on the European vulnerability database established under Article 12 of Directive (EU) 2022/2555, or on the other online repositories referred to in Article 55(1), point (d), of Regulation (EU) 2019/881 (Article 39).

If ACN notifies you of a specific vulnerability you are exposed to, as an entity in Article 1(1), a national cybersecurity perimeter entity or an electronic communications provider under Article 40(3) of the Electronic Communications Code, apply the remedies it indicates without delay and within 15 days of its notice, unless technical or organisational reasons you have promptly communicated to ACN prevent it (Article 2).

Once the competent cyber incident prevention institution relays a substantiated report that a vulnerability exists in a system or network you operate, remediate it within the deadline the institution sets, no later than 90 days from when you received the information.

At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.